CVE-2022-2357 WSM Downloader <= 1.4.0 - Unauthenticated Arbitrary File Download

Q: What is CVE-2022-2357?

CVE-2022-2357 is a high-severity path traversal vulnerability in Unknown WSM Downloader, published on 8 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2022-2357 being exploited?

There is no known exploitation of CVE-2022-2357 in the wild and no public exploit code.

Q: How do I fix CVE-2022-2357?

No fix has been published for CVE-2022-2357 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 8 Aug 2022 Updated 3 Aug 2024

Unauthenticated attackers can download sensitive local files, such as configuration files, via the remote file download feature.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-2357?

CVE-2022-2357 is a high-severity path traversal vulnerability in Unknown WSM Downloader, published on 8 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WSM Downloader WordPress plugin through 1.4.0 allows any visitor to use its remote file download feature to download any local files, including sensitive ones like wp-config.php.

Weakness: CWE-552

Which versions are affected by CVE-2022-2357?

It affects 1 product.

Products include Wsm Downloader Project Wsm Downloader.

How do I fix CVE-2022-2357?

No fix has been published for CVE-2022-2357 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-2357 being exploited?

There is no known exploitation of CVE-2022-2357 in the wild and no public exploit code.

CVE-2022-2367 WSM Downloader <= 1.4.0 - Domain Name Restriction Bypass High 7.5

Sources

Also known as GHSA-j7q2-cxfq-x3j6.